Description
phpGroupWare before 0.9.7 allows remote attackers to execute arbitrary PHP commands by specifying a malicious include file in the phpgw_info parameter of the phpgw.inc.php program.
References
- 1682 vdb-entry
- 20001206 (SRADV00006) Remote command execution vulnerabilities in phpGroupWare mailing-list
- http://sourceforge.net/project/shownotes.php?release_id=17604
- phpgroupware-include-files(5650) vdb-entry
- 2069 vdb-entry